# Windows 10 Extended Security Updates: What Businesses Get, and When to Stop Paying URL: https://limehawk.io/reports/windows-10-extended-security-updates Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min Windows 10 support ended Oct 14, 2025. Business ESU buys up to three years of security-only patches, one year at a time, and Year 1 ends Oct 13, 2026. > **TL;DR** Windows 10 reached end of support on October 14, 2025. Extended Security Updates (ESU) is Microsoft's paid program that keeps critical and important security patches coming to Windows 10 PCs after that date. Businesses buy it one year at a time, for a maximum of three years, through volume licensing. Year 1 coverage ends October 13, 2026, Year 2 ends October 12, 2027, and Year 3 ends October 10, 2028. ESU is security fixes only. No features, no bug fixes, no general support. Microsoft calls it a temporary bridge, and that's how to use it: buy time for PCs you can't replace yet, and isolate anything that has to stay on Windows 10 past that. - ESU Year 1 ends: Oct 13, 2026 ## Is Windows 10 still supported? No. Microsoft ended support for Windows 10 on October 14, 2025. Version 22H2 was the last release, according to the [Windows 10 Home and Pro lifecycle page](https://learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro). The PCs still turn on and run your software. What stopped is the monthly security patching, along with technical support and feature updates. Microsoft's [ESU program page](https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates) puts it plainly: Windows 10 PCs "will continue to work." But after that date, Microsoft no longer provides technical support, feature updates, or "quality updates (including security and reliability fixes)." A Windows 10 PC that isn't enrolled in ESU has gone without patches since the October 2025 release. Every Windows flaw found since then stays open on that machine. LTSC editions are the exception. Those have their own lifecycles and aren't part of this program. ## What are Windows 10 Extended Security Updates? Extended Security Updates (ESU) is a paid, annual subscription that keeps sending critical and important security updates to enrolled Windows 10 PCs after end of support. Microsoft's [lifecycle FAQ](https://learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates) calls ESU "a last resort paid option" and "not intended as a long-term solution, but rather as a temporary bridge." It doesn't extend the product's lifecycle. Here's what ESU leaves out, per Microsoft: - New features. - Customer-requested non-security updates. - Design change requests. - General technical support. Microsoft only supports activation, installation, and regressions caused by the ESU updates themselves. Even that requires an active Microsoft support plan. So ESU fixes security holes. It won't fix a printer driver, a broken update, or anything else that goes wrong on the PC. ## How long do Windows 10 ESU updates last for businesses? Business ESU runs one year at a time, for a maximum of three years after end of support. Microsoft's [lifecycle FAQ table](https://learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates) lists the end dates: - **Year 1** ends October 13, 2026. - **Year 2** ends October 12, 2027. - **Year 3** ends October 10, 2028. You can't buy partial periods. ESU is also cumulative. Microsoft says that if you buy in Year 2, "you have to pay for Year 1 too." Skipping a year to save money doesn't work, and joining late means paying for the time you missed. As of this writing, Year 1 ends Oct 13, 2026. If you enrolled PCs last fall, Year 2 has to be bought and activated on every machine, or patching stops again. ## Which PCs and editions qualify? Business ESU covers Windows 10 Pro, Enterprise, and Education "in Commercial use." Microsoft lists those editions in its lifecycle FAQ. The minimum purchase is one license, so a 10-person office can buy exactly what it needs. There's also a consumer ESU program. Don't confuse the two. Microsoft's [consumer ESU page](https://www.microsoft.com/en-us/windows/extended-security-updates) says it "can't be used in commercial scenarios." A business PC goes through volume licensing, not the Settings app. Some PCs get ESU without a separate purchase. Microsoft lists Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, and Azure as covered at no additional cost. Windows 10 PCs that connect to Windows 365 Cloud PCs are covered for up to three years with an active Windows 365 license. ## How do you enroll a business PC in ESU? You buy ESU licenses through Microsoft volume licensing, then activate a key on every PC. Microsoft's [enablement guide](https://learn.microsoft.com/en-us/windows/whats-new/enable-extended-security-updates) lists the steps. Each machine has to meet these prerequisites first: - Windows 10, version 22H2, with KB5066791 or a later update installed. - The ESU Licensing Preparation Package, KB5072653, installed after KB5066791. - Admin rights on the device. Then: 1. **Get the key.** The Multiple Activation Key (MAK) is in the Microsoft 365 admin center under Billing, Your Products, Volume licensing. Your account needs the Product Key Reader or VL Administrator role to see it. 2. **Install the key** on each PC from an elevated prompt with `slmgr.vbs /ipk`. 3. **Activate the right year.** Each year has its own Activation ID, and you run `slmgr.vbs /ato` with it. A Year 1 activation doesn't carry the PC into Year 2. 4. **Verify.** `slmgr.vbs /dlv` should show the ESU program name with a status of Licensed. PCs that can't reach the internet can activate by phone. Large offline fleets can use VAMT proxy activation. Reimaging a PC can use up activations, and Microsoft lets you request more. Run this by hand on three PCs and it's fine. On forty PCs, every year, it's a scripted job that needs a report of which machines activated and which didn't. That's the kind of work our [managed IT service](/services/managed-it-security) handles. ## When does ESU make sense, and when should you replace the PC? ESU makes sense when a PC can't move to Windows 11 yet and you need it patched while you work out a plan. It doesn't make sense as a way to avoid buying hardware. You'd be paying every year to keep a machine on an operating system that's already done. Start by sorting your Windows 10 PCs into three groups: - **Can upgrade.** The PC meets [Windows 11's hardware requirements](https://learn.microsoft.com/en-us/windows/whats-new/windows-11-requirements): a compatible 64-bit processor with two or more cores, 4 GB of RAM, 64 GB of storage, UEFI with Secure Boot, and TPM 2.0. Upgrade it. ESU on this machine is money spent on a problem you can just fix. - **Can't upgrade, but nothing ties it to Windows 10.** Usually older hardware without TPM 2.0 or a supported CPU. Replace it. ESU can cover the gap until the new PC shows up, and the move doesn't have to be painful. In our [USMT profile migration](/reports/usmt-profile-migration), a CFO's documents, app settings, and browser data moved to a new machine with zero data loss, and USMT works across Windows versions, Windows 10 to 11 included. - **Has to stay on Windows 10.** A vendor app or a piece of equipment only runs on it. ESU buys up to three years of patches. Use that time to get a real answer from the vendor. An ESU patch also still has to install. Patching failures don't stop because you paid for the patches. Our [Windows Update reset report](/reports/reset-windows-update) shows what a failed update looks like on a live machine, and an enrolled PC needs the same monitoring as any other. ## What do you do with a PC that has to stay on Windows 10? Isolate it. A PC you can't patch, or won't be able to after October 10, 2028, shouldn't sit on the same network as everything else. We handle it the same way we handle the Windows 7 and XP machines on our [legacy systems service](/services/legacy-systems): - Put it on its own network segment, away from the rest of the office. - Write firewall rules that only allow the traffic it actually needs. - Air-gap it where the workflow allows. - Watch it at the network layer so problems show up even when the box can't run modern tools. The goal is containment. If the old PC gets compromised, it can't reach anything else. ESU and isolation work together, not as either/or. Patch it while you can, isolate it regardless, and plan for the day the patches stop. ## Key takeaways - Windows 10 support ended October 14, 2025. The PCs still boot, but without ESU they get no more security patches. - Business ESU runs one year at a time for up to three years: Year 1 ends October 13, 2026, Year 2 ends October 12, 2027, and Year 3 ends October 10, 2028. - ESU is cumulative. Join in Year 2 and you pay for Year 1 too. The consumer ESU program can't be used in commercial scenarios. - Each PC needs Windows 10 22H2, two prerequisite updates, an ESU key from the Microsoft 365 admin center, and activation with the right year's Activation ID. - ESU is a bridge, not a plan. Replace or upgrade what you can, and isolate anything that has to stay on Windows 10. ## What this looks like when we do it We start with an inventory: every Windows 10 PC, its edition, its version, and whether its hardware can run Windows 11. Upgradable machines get upgraded. Old hardware gets a replacement date, and the profile moves over when the new PC arrives. ESU goes only on the machines that truly need the bridge. For the PCs on ESU, we track activation by year, so nobody finds out in October that half the office stopped getting patches. For anything that has to stay on Windows 10, we segment it and document why it's there. That's routine work on our [legacy systems service](/services/legacy-systems), where machines a lot older than Windows 10 still run in production. Still have Windows 10 PCs and no plan for Year 2? Book a call and we'll sort the list with you.